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Director, FBI (252-D2-C2187) (P) 


SAC, Boston 
Attention: Supervi 
(SSA) 
Special Agent (SA) 


COMPUTER SECURITY AND CRIME RESEARCH PROJECT (CSCRP) 
NATIONAL CENTER FOR THE ANALYSIS OF VIOLENT 
CRIME (NCAVC) - RESEARCH 


00: 


releasable to Forel 


Buairtel 10/30/91, to Boston; retelcal 10/31/91, to 
from rogram Manager, NCAVC, 
(U) 


SSA 


D2 


This communication is classified " * and not 
i ORN,"™ unless otherwise noted. 


Quantico. 


Referenced airtel notified Boston of the fact that 


another one of a series of periodic meetings would be held on 
(11/1/91, between the NCAVC and Digital Equipment Corporation 
(DEC), Office of Security, Maynard, Massachusetts. The 


knowledgeable points of contact at 
and 
ro} individuals can be reached a 


Digital Equipment Corporation, 111 Powdermill Road, MS02-1/G17, 
Maynard, Massachusetts 01754, telephone numbers 508-493-4088 and 


508-493-5464 (facsimile). (U) alee. pty ) 
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Airtel to SAC, Boston from Director, FBI 
Re: Computer Security and Crime Research Project (CSCRP) 
National Center for the Analysis of Violent 
Crime (NCAVC) - Research 
00: D2. 


Referenced telephone call was to discuss with 
Boston wh benefits could be derived from the meeting at DEC. 
esa | provides periodic Development of Espionage and 
Counterintelligence Awareness (DECA) Program briefings to 
companies within the Boston area. (U) 


oject j our-vyear study co-sponsored and 
funded by The primary 
purpose of the project is to research offender characteristics 
("profiles") of computer criminals. The NCAVC is also testing a 
high security computer for[ __|which is manufactured by DEC. (U) 


The reason for continued liaison with DEC is that 
historically, DEC has been an international target of computer 
criminals. According to DEC officials, these offenders routinely 
attempt to steal or otherwise obtain their hardware and software, 
maliciously damage computer systems, or compromise the integrity 
of their telecommunication circuits. (U) 


As a direct result of the m j 
following information was provided by 


for dissemination only within the FBI: 


1. International Impact. DEC is undergoing numerous 
international changes which greatly impact upon its safety and 
security. Cited examples include: 


o Multi-national offices are now being opened in 
critical and sensitive areas of the world (e. Ser Russia, Poland, 
France, Israel, and China). 


o Employees now frequently travel among the 
various international DEC offices, often coming to the U.S. for 
temporary three-year periods of duty. 


: o Employees now have greater access to critical 
and sensitive research, accounting, and personnel records. 


o DEC has become the victim of numerous thefts of 
commercial hardware and software. ASAE). (1) 
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COMPUTER SECURITY AND CRIME RESEARCH PROJECT (CSCRP) 
NCAVC - RESEARCH 
00: D2 


Re telcal 10/29/91, to SA — from[ si 
Program Manager, National Center for the Analysis of 
Violent Crime (NCAVC), Quantico. 


Referenced telephone message was to inform Boston of 
another of a series of periodic meetings between the NCAVC and 
Digital Equipment Corporation (DEC), Office of Security, Maynard, 


Massachusetts. The knowledgeable points of contact at DEC are 
[_—<$$—$—$—— ane 


tione roject is a four-year study co-sponsored and 
funded by The primary 
purpose of the project is to research offender characteristics 
(sprofiles") of computer c inals. The NCAVC is also testing a 
h#gh security computer feet leaden is manufactured by DEC. 


The reason for continued liaison with DEC is that 
historically, DEC has been an international target of computer 
criminals, who routinely attempt to steal or otherwise obtain 
hardware and software, maliciously damage computer systems, or 
compromise the integrity of mainte ee ai fige Fy 

The primary goal of CSCRP for Fiscal sdf i492 iS the 
development of a computer crime offender classification system. 
These results will be placed in the NCAVC's Crime Classification 


avdAdm._ Manual (CCM) Project. On 11/1/91,[___——sdwW plans to meet again 
Met Dan With DEC's Office of Security to brief their staff on the CCM 
Adm.sevs. project and to solicit their continuing cooperation in CSCRP. 
crim.Iw. ——Boston:is encouraged to maintain contact with DEC, who is 


dent. 


Tech. Servs. 
Training 
Cong. Affs. Off. 
Off. of EEO 
Off. Liaison & 
Int. Affs. 


info.Mgnt. receptive to innovative training methods. 


Legal Coun. —2 - WMFO 


Oft. of Public Afts. _ 


Telephone Rm. —_ 


MAIL, ROOM 


Director's Office___ 
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Airtel to SAC, Boston from Director, FBI 
Re: Computer Security and Crime Research Project (CSCRP) 
National Center for the Analysis of Violent 
Crime (NCAVC) - Research 
00: D2 


4. Technology Transfer. DEC has been victimized over 
the years in technology transfer cases, even though a stringent 
export clearance compliance program exists. Recent examples 
include: 


o Diversion of export-approved equipment and 
software to a Middle Eastern country not authorized to obtain 
that technology. 


o DEC cites that a recent emerging market for 
stolen computer boards and questionable third-party vendors 
further complicates the technology transfer problem. EL (0) 


5. Crime Control Manual. The primary goal of CSCRP 
for Fiscal Year 1992 is the development of a computer crime 
offender classification system. These results will be placed in 
the NCAVC's Crime Classification Manual (CCM) Project. (U) 


DEC's Office of Security endorsed this project and will 
participate in the research and development efforts for the CCM 
Project. They have already provided the name of a convicted 
computer criminal whom they have interviewed. (U) 
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Airtel to SAC, Boston from Director, FBI 
Re: Computer Security and Crime Research Project (CSCRP) 
National Center for the Analysis of Violent 
Crime (NCAVC) - Research 
oo; D2 


6. Priorities from the FBI. Several priorities were 
set forward by DEC's Office of Security in regards to cooperative 
efforts with the FBI. These items will be discussed directly 
with FBIHQ personnel at an upcoming meeting planned for January, 
1992. 


©o Responsiveness from the FBI in major computer 
crime cases in which DEC is a direct victim. 


o Cooperative FBI/DEC training programs, which 
should include major case management, ethics, and report writing. 


o Rapid dissemination of threat information to 
the computer industry and more DECA briefings. 


o Closer cooperation with the Department of 
Defense funded Computer Emergency Résponse Team Coordination 
Center (CERT/CC), located at Carnegie Mellon University, 
Pittsburgh, Pennsylvania. 


o Assistance in the development of industry 
ethics guidelines, particularly in the area of the thefts of 
copyrighted software. (U) 


Boston is advised that no commitments have been made to 
DEC by the NCAVC. However, the NCAVC will continue to provide 
liaison, as requested, to assist in fostering amicable relations 
between the FBI and DEC. 


Intelligence Division; SSA Criminal 


Pvestigat ive Division; SSA Boston; and SsSA[_sd 


Washington Metropolitan Field Office. (U) 


Coordination for this communication was with Program 
Managef gence piviwions seal _ Unit chief[ 
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Airtel to SAC, Boston from Director, FBI 
Re: Computer Security and Crime Research Project (CSCRP) 
National Center for the Analysis of Violent 
Crime (NCAVC) - Research 
oo: D2 


2. Networks. DEC now has the largest private 
telecommunication (telephone and computer) network in the world. 
Problems associated with this network include: 


o Instantaneous and free exchange of data and 
software over a network of 65,000 separate computers. 


o Access to sensitive software, research and 
development facilities, and corporate data. This data and 
technology tends to be centralized within DEC. 


o Access to a worldwide private telephone 
network. 


o Restrictions in certain countries of the world 
prevent private firms from being able to encrypt the data sent 
over their telecommunication networks. These restrictions are 
either imposed by U.S. export controls or by individual country 
telecommunication secrecy policies. 
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3. Industrial Espionage. DEC faces a dilemma in that 
host nationals employed by DEC owe their primary allegiance to 
their own country and secondary allegiance to the company. 
Recently, loyal employees have stepped forward and notified DEC's 
Office of Security of unusual requests. Examples of industrial 
espionage incidents to date include: 


o Employees have been asked to provide internal 
DEC corporate information to their country. 


o Employees have been suspected as intelligence 
officers of their native country. 


o The recent theft of a very sensitive advanced 
computer system called "Alpha Project." DEC's internal 
investigation is continuing, and the motive is unresolved. 
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